...
Allow Microsoft Installer Policy - This policy allows any child process of Windows Installer to execute. This prevents Windows Installer child processes falling under any Unclassified Applications policies.
Catch-all Blacklist
Deny Manual Security Rated Blacklist Execution - This policy prevents execution of any files marked with a manual security rating of 'blacklist.'
New Software Delivery Package Whitelist Policy
Orangelist New Applications
Package Whitelist
Reference System Whitelist
Trusted File Owner Policy
Whitelist Microsoft Applications